UniPassUniPass is a local-first, zero-knowledge password manager. By design we do everything we can to minimize the data we can see — because data we can see is data that can leak.
- Local-first: vault data is encrypted on your device with XChaCha20-Poly1305 before it ever leaves.
- Sync is optional: off by default; when enabled, only end-to-end encrypted ciphertext is uploaded. We have no keys and cannot decrypt it.
- Zero telemetry: no usage analytics, crash reporting, or behavioral tracking.
- We don't sell data, run ads, or profile you.
What we collect
Without cloud sync (local mode)
No account or vault data is sent to UniPass. Your master password, vault contents, Secret Key, and device identifiers stay on your device. The desktop app can still make the favicon and user-initiated breach-check requests described below; those services receive your network IP as part of an ordinary HTTPS connection.
With cloud sync enabled
Only the following is uploaded to our sync server:
| Category | Uploaded? | Notes |
|---|---|---|
| Master password | No | Never leaves the device; the server only sees an Argon2id-derived auth hash (irreversible). |
| Vault records (logins, notes, cards, etc.) | Ciphertext only | Opaque XChaCha20-Poly1305 blobs; the server has no key to decrypt them. |
| Secret Key | No | Generated at sign-up, stored in the device Keychain, and never sent in plaintext. |
| Recovery Code | No | The code is displayed once and never uploaded. If you enable recovery, the server stores only an encrypted recovery envelope and a one-way verifier. |
| Sync metadata | Yes | Account email, device name/type, sync timestamps, record version numbers. |
| Usage analytics / telemetry | No | No analytics SDKs integrated (no Sentry / Firebase / GA / Mixpanel). |
| Crash reports | No | No crash reporting integrated. |
| Client IP | Transient | Kept only in web access logs as operationally needed; not written to the user database. |
| Favicons | See below | The stored domain can be sent to the target site and, on fallback, Google's Favicon service. No username, password, note, or other vault field is sent. |
| Password breach check | See below | Only when you run the check, the first five characters of each password's SHA-1 hash are sent to Have I Been Pwned's range API. Plaintext passwords and full hashes are not sent. |
We never upload your master password or any derived key, plaintext vault content, or your browser history, clipboard, or filenames.
Enabling cloud sync is an explicit action — you must enter a server URL and confirm under Settings → Cloud Sync in the desktop app.
The browser extension
The UniPass browser extension for Microsoft Edge and other supported Chromium-based browsers is a companion to the desktop app. It detects login forms, fills credentials in response to user actions, and handles submitted login values only to offer a local save or update prompt. Credentials travel only between the extension and the local desktop app through your operating system's Native Messaging channel — never over the network to us. The extension contains no analytics and sends no browsing data anywhere.
Third-party services
- Favicon fetching: when an item has a domain and no fresh cached icon, UniPass first requests
https://<domain>/favicon.ico. If that fails, it requests Google's Favicon service with the domain and icon size. The target site or Google therefore receives the domain and your network IP, but no username, password, note, or other vault field. - Have I Been Pwned password range API: only after you choose to run a breach check, UniPass hashes passwords locally and sends the first five hexadecimal characters of each SHA-1 hash with response padding enabled. The plaintext password and remaining hash characters never leave the device. Have I Been Pwned receives the prefix and your network IP.
- Sync server (only if you enable sync): a server operated by the UniPass team, reached over HTTPS + WebSocket, exchanging only ciphertext and sync metadata.
UniPass does not use third-party advertising or analytics services.
Where data is stored
All local data lives in the standard OS user-data directory:
- macOS:
~/Library/Application Support/io.loxnet.unipass/
The database is encrypted with SQLCipher using a key derived from your master password. OS file permissions (0600) prevent other users from reading it.
Data deletion
- A single record: moved to Trash, permanently deleted after 30 days, or removed immediately by you.
- Your entire local vault: uninstall UniPass or delete
~/Library/Application Support/io.loxnet.unipass/to remove all local data. - Server data: revoke a device or delete your account under Settings → Cloud Sync; deletion clears the server-side ciphertext and sync metadata. Uninstalling the client does not automatically delete server data.
Children's privacy
UniPass is not directed to children under 13 and does not knowingly collect personal data from minors.
Changes
Revisions to this policy are announced in the project's release notes. Material changes will be communicated to users in advance.
Contact
- Privacy enquiries: business@loxnet.io
- Security disclosure: business@loxnet.io (subject prefix
[SECURITY]; see our Security page)
Operator and proposed billing data processing
UniPass is operated by 上海洛克斯网络科技有限公司. Privacy contact: business@loxnet.io.
Commercial subscriptions are not enabled. At launch, Paddle is planned to process checkout and payment details. UniPass would receive customer, order and subscription identifiers, billing email, plan, payment status and renewal dates needed to link an account, deliver benefits, support customers, handle refunds and maintain billing records. UniPass would not receive full card numbers or card security codes, or send vault contents to the payment provider.
The exact billing fields, cross-border processing arrangements and statutory retention periods will be published after integration validation and before charging begins. See Paddle’s privacy policy for its processing. This section describes proposed processing, not current billing activity.